chaplic

That's the issue, nothing to do with outlook It's a service called NCSI and if it thinks you dont have internet access, apps that respect the crap it spews out will not even try to connect You will find a million suspected causes of it, everything from NIC drivers to a few registry keys. I guess the good news here is if it's consistently not working you should be able to determine what fixes it by trial-and-error

Hard to say for sure but something has changed. Any tenant created in the last few years will have modern auth turned on as default and I suspect MS will have turned it on for all some time ago for all (too lazy to check ). But I say this because Microsoft are turning off the old-school basic authentication very soon. It could have been the supplier has moved from ADFS to PHS for auth; from their own servers to Microsoft. Badly configured client settings for ADFS would cause a modal dialog box which would never appear for forms-based PHS auth. Given the BS you've been fed I would ask them about if you have any devices that will cease to work post basic auth disablement; they should be able to tell you affected users and clues to the device very quickly.

That's a terrible response from the supplier - lazy and misinformation. The popup web browser is called modern authentication and is the future. It means it can ask you for an MFA code, or biometric stuff like Windows Hello. So yes its right and expected.

Use FSLogix to store onedrive files-on-demand in what is basically a roaming profile. Might not meet your use case especially if laptops are in use. Overall I think this is a 'wouldn't start from here' problem. Onedrive mapper cannot be anything more than a tactical workaround a 1GB file is always going to take time to open from a a remote location but is presumably the exception rather than the rule.

How Id do this 1) Setup Azure AD connect and configure it ONLY sync an OU that no-one else is in. Create a few test accounts and get comfortable seeing them sync to the cloud 2) For a user who has an AD account and a 'Synced: No' account, get their Object ID from Azure AD. e.g. $upn = $user = Get-MsolUser -UserPrincipalName $upn $immutableid = $user.immutableId $immutableid will be something like5c49ad3c-db2e-402a-b8da-901ec4f481a4 Then do some maths to convert that do an MS-DS-Consisntecyguid: [system.convert]::FromBase64String($immutableid) | %{$a += [system.String]::Format("{0:X}", $_) + " "};$result = $null;$result = $a.trimend();$result $result will something like CB 69 08 D8 D3 34 D8 45 88 F5 53 5D 64 AE DF 0F Put this value in the ms-ds-consistencyguid in AD (use the attribute editor in ADUC or powershell) Sync AAD, possibly twice. Look at the Azure AD audit logs to see changes. Once you're happy, scale out. Note the users O365 password is now their AD password and lgfl will be unable to edit their values as they are sourced from AD. Do NOT let a user account sync from AD unless you've got the right value in ms-ds-consistencyguid otherwise it'll get confusing with duplicates.

I've been doing a lot with Graph API in powershell before these new modules and dont really see the benefit of the autogenerated cmdlets. If I use the 'real' graph API call then I can repro what I'm doing using the Graph API explorer.

Nothing sensible. If you wanted to home-brew something like it.: Have a rule-based connected that ships all email to a on-prem SMTP server for a selected group of users. Have a second on-prem SMTP server that ships email to O365 (and is allowlisted to do so etc). Manipulate the stop and start of SMTP services so mail is collected in on the incoming SMTP, queued there, then sent back to O365 when the SMTP service starts. This is a daft solution, dont do it. ​You can setup email moderation which is perhaps more appropriate but would require a human unless you get clever.

If your mailboxes are on prem, the calendar integration doesn't 'just work', you need to setup a connection and allow oauth auth if I recall. Get em moved to O365 ;-)

Are you ​sure​ those O365 accounts are synced from on-premise AD (they have the same password and you can only modify users details in AD not in O365) O365 cannot sync down to the server as thre should be no need if AD is the source of these accounts/ Theres a few options. My suggestions would be to have your machines ONLY Azure Active Directory joined and Id use onedrive for personal files

To answer your first question, merely syncing user accounts into Azure AD using Azure AD Connect doesnt attract any licensing requirements and you can do it now. Not that it'll be all that useful but at least its a task to get out of the way.

We have about 7 year old ex corporate laptops, so Core I5s of that vintage but withn 120GB SSDs (and replacement batteries). Don’t think they are that heavily used but no complaints. Wont take Windows 11 though. Unscientifically the couple of new DFE freebies we got (with MMC storage and a crappy processor) felt a lot slower.

I’m sceptical of the app really ​​needs server 2012 although domain functional level of 2012 is a genuine requirement for brain dead telephony solutions and similar. Happily brand spanking new Windows OSs can run old domain functional level. If the legacy tech really needs server 2012, then treat it as a leper and run it in a VM, taking the exisiting machine, P2V and remove other services if required. Build a new Server, join to domain, move fsmo roles. Then roll other services across to it as you see fit.

Not like that. I’m joining a few dots, but you should create the user in AD with the new UPN and have that project in Azure AD.

Create a profile without a mail account then ctrl+ right click outlook icon in bottom right and select test autoconfiguraiton. Untick guesssmart boxes and fill in the rest. Does this return you server details (many steps may fail by design so don't get too carried away)

Enabled basic smtp auth for the account? is conditional access blocking it? what does Azure AD connect logs say? Setup an SMTP client on a PC and try the same settings.

Should work with any browser; will require your desired browser to be set as default though. Can't see anything wrong there otherwise unless a HKCU key is somehow contradicting it.

send an email from hotmail or simliar to [email protected] - it will NDR but probably take a few minutes and if you read the NDR you'll see it says message loop detected Make the change to authoriative, give it 10 mins, repeat the test and NDR will happen almost immediately. So it's not a massive win and I've seen plenty orgs with the wrong setting run quite happily, but if you dont have hybrid or any other system with your domains email should be a no drama tidyup.

I was in a similar boat No solution for DHCP so I have a little NUC box running DHCPServer.De as does the business managers PC which also runs sims. dhcpserver.de can do DNS and basic web site to host pac file if required NUC box also runs a VM which has PRTG and related just to give me some basic monintoring. Powershell job copies the monitoring VM to the business manager PC weekly for convenience. I just do printing IP direct. It's been pretty bulletproofproof since it went in a couple of years ago.

If all your email is inside O365, Authoritative. If your email goes to on prem first then O365, authoriative. If you take email from internet to O365 then pump some to other systems, internal relay. Else what will happen is if someone emails an address that doesn't exist, O365 will pass it down whatever connector it is appropriate, probably just to the internet. So it will NDR but only because an email loop will be detected

Your heads O365 account will also have a @tennantname.onmicrosoft.com address so use that as the forwarding address in Gmail Or setup a “migration” from Gmail to O365 for one account and run the sync often. Or just configure outlook with Imap and take care to configure imap against gmail labels

Yes. AADSyc will error without capital SMTP so address based on UPN but it's not elegant. Also, dump all proxyAddresses from O365 too as might be blank in AD but you might find some X500 addresses in O365. If so, add them to AD proxyaddresses too.

Glad you didn’t share how, no-one wants to know

Assume these are cloud accounts? Got Azure AD Connect? Got ability to query AAD via powershell just not a GA? Get the object ID of admin account in O365 pick and account in AD. Translate the objectGUID of the AAD account to the value for Ms-ds-consistencyguid and pop into that field in AD Sync The AD account will hard match with the cloud account and you can sign in with the password. boom. l337 haxors R us.

There’s nothing stopping you creating a new active directory alongside what you have called whatever you want (say Microsoft.com) However Id suggest no matter how attractive a new, clean active directory sounds it’s a world of pain for zero business benefit. Learn what’s there and why, Fix up what’s there, add a UPN suffix

You were along the right lines though some of the special attributes are a bit fussy, I think onpremisessamaccountname should be fine. Assuming onpremisessamaccountname is actually populated. To diagnose fully I’d use a browser plugin like samlspy to see what nameid AAD is passing to the end app via the browser